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(54) Methods and apparatus for a computer network firewall with statef ul packet filtering 

(57) The invention provides improved computer net- 
work firewalls which include one or more features for 
increased processing efficiency. A firewall in accord- 
ance with the Invention can support multiple security 
policies, multiple users or both, by applying any one of 
several distinct sets of access rules. The firewall can 
also be configured to utilize "statefuP packet filtering 
which involves caching rule processing results for one 
or more packets, and then utilizing the cached results 
to bypass rule processing for subsequent similar pack- 
ets. To facilitate passage to a user, by a firewall, of a 
separate later transmission which Is property In re- 
sponse to an original transmission, a dependency mask 
can be set based on session data items such as source 
host address, destination host address, and type of 
sen/ice. The mask can be used to query a cache of ac- 
tive sessions being processed by the firewall, such that 
a rule can be selected based on the number of sessions 
that satisfy the query. Dynamic rules may be used in ad- 
dition to pre-loaded access rules in order to simplify rule • . 
processing. To unburden the firewall of application prox- 
ies, the firewall can be enabled to redirect a networkses- 
sion to a separate server for processing. 
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(57) The invention provides improved computer net- 
work firewalls which include one or more features for 
increased processing efficiency. A firewall in accord- 
ance with the invention can support multiple security 
policies, multiple users or both, by applying any one of 
several distinct sets of access mles. The firewall can 
also be configured to utilize "stateful' packet filtering 
which involves caching rule processing results for one 
or more packets, and then utilizing the cached results 
to bypass rule processing for subsequent similar pack- 
ets. To facilitate passage to a user, by a firewall, of a 
separate later transmission which is properly in re- 
sponse to an original transmission, a dependency mask 
can be set based on sessk)n data items such as source 
host address, destination host address, and type of 
service. The mask can be used to query a cache of ac- 
tive sessions being processed by the firewall; such that 
a rule can be selected teased on the number of sessions 
that satisfy the query. Dynamic rules may be used m ad- 
ditk>n to pre-loaded access rules in order to simplify rule 
processing. To unburden the firewall of application prox- 
ies, the firewall can be enabled to redirect a network ses- 
sion to a separate server for processing. 
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Description 

Field of the Invention 

[0001] This invention relates to the prevention of unauthorized access in computer networks and. more particularly, 
to firewall protection wrthin computer networks. 

Background of the Invention 

[0002] In computer networks. InfomTation Is conventionally transmitted in the form of packets. Information present 
at one site may be accessed by or transmitted to another site at the command of the former or the latter. Thus, e.g., if 
infomiation is proprietary, there is a need for safeguards against unauthorized access. To this end, technk^ues known 
as packet filtering, effected at a network processor component known as a firewall, have been develc^ed and com- 
mercialized. At the firewall, packets are inspected and filtered, i,e. , passed on or dropped depending on whether they 
conform to a set of predefined access rules. Conventionally, these rule sets are represented in tabular form. 
[0003] Typically, a firewall administrator altows broad access which is consented to from one side of the firewall to 
the other, but blocks transmissions in the opposite direction whfch are not part of an active network session. For ex- 
ample, "inside* company employees may have unrestricted access through the firewall to an "outside" network such 
as the Internet, but access from the Internet is blocked unless it has been specifically authorized. In addftton to such 
a firewall at a corporate boundary to the Internet, firewalls can be interposed between network domains, and can also 
be used within a domain to protect sub-domains. In each case, different security policies may be involved. 
[0004] In certain complex network protocols, separate, additional network sessions are required from the outskie 
back to the user. One such complex protocol is employed by a sewice known by the trade name "RealAudio.* Without 
special measures, the request for the separate session will be blocked by the firewall. 

[0005] For such complex protocols, separate "proxy" processes have been devetoped to run concurrently on the 
firewall processor on behalf of the user. Proxy processes have also been developed for other special-purpose appli- 
cations, e.g., to perform sen/ices such as authentication, mail handling, and virus scanning. 

[0006] In the interest of maximizing the number of sessions which can run concurrently, since the capacity of a firewall 
processor to support concurrent processes is limited, it is desirable to minimize the need for proxy processes on the 
firewall. Such minimization is desirable further In the Interest of over-all transmission rate, as passage of incoming data 
through separate processes tends to slow transmission down. 

Summary of the Invention 

[0007] The present invention provides techniques for implementing computer network firewalls so as to improve 
processing efficiency, improve security, increase access njle flexibility, and enhance the ability of a firewall to deal with 
complex protocols. In accordance with a first aspect of the Invention, a computer network firewall is able to support (a) 
multiple security polfcies. (b) multiple users, or (c) multiple security policies as well as multiple users, by applying any 
one of several distinct sets of access njles for a given packet. The particular njle set that is applied for any packet can 
be determined based on infomfiation such as the incoming and outgoing network interfaces as well as the network 
source and destination addresses. 

[0008] In accordance with a second aspect of the invention, a computer network firewall can be configured to utilize 
"slateful" packet filtering which improves performance by storing the results of rule processing applied to one or more 
packets. Statef ul packet filtering may be implemented by caching rule processing results tor one or more packets, and 
then utilizing the cached results to bypass rule processing for subsequent similar packets. For example, the results of 
applying a rule set to a particular packet of a networi^ sesston may be cached, such that when a subsequent packet 
from the same network session arrives In the firewall, the cached results from the previous packet are used for the 
subsequent packet. This avoids the need to apply the njle set to each incoming packet. 

[0009] In accordance with a third aspect of the invention, a computer network firewall authorizes or prevents certain 
network 8essk>ns using a dependency mask which can be set based on session data items such as source host 
address, destination host address, and type of sendee. The dependency mask can be used to query a cache of active 
sessions being processed by the firewall, to thereby identify the number of sessions that satisfy the query. The query 
may be associated with an access aile. such that the selection of that particular rule is dependent on the number of 
successful matches to the query. 

[0010] In accordance with a fourth aspect of the invention, a computer network firewall nr^ay make use of dynamic 
rules which are added to a set of access rules for processing packets. The dynamic rules altow a given rule set to be 
modified based on events happening in the networt^ without requiring that the entire rule set be reloaded. Exemplary 
dynamic rules include a "one-time' mle which is only used for a single session, a time-limited rule which is used only 
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for a specified time period, and a threshold rule which is used only when certain conditions are satisfied. Other types 
of dynamic rules include rules which define a host group» such that the host group can be modified to add or drop 
different hosts without altering other aspects of the access rule set 

[0011] In accordance with a fifth aspect of the invention, a computer network firewall can be instructed to redirect a 
network session to a separate server for processing, so as to unburden the firewall of application proxies. The separate 
sen/er processes the redirected network session, and then passes the session back through the firewall to the intended 
original destination. 

[0012] The computer network firewalls of the present inventbn facilitate firewall processing in a wkJe variety of im* 
portant applications. For example, the invention nr^ be implemented in a dial-up access gateway. Another exemplary 
embodiment of the invention may be implemented in a distributed manner with a first portion of the firewall resident in 
the network and a second portion of the firewall resident in a set-top box. computer or other user terminal in a home 
or business. The tatter embodiment can allow the firewall technques of the invention to provide, for example, parental 
control of Internet and video access in the home. These and other features and advantages of the present invention 
wfll become more apparent f rom the accompanying drawings and the foltowvig detailed description. 

Brief Description of the Drawings 

[0013] Fig. 1 is a schematic of several user sites or domains connected to the Internet via a local area network 
providing firewall protection to the user sites. 

[0014] Fig. 2 is a schematic of a user site connected to the Internet and including internal firewalls. 

[0015] Fig. 3 is a schematic which illustrates a rule table. 

[0016] Fig. 4 is a schematic which illustrates a cache. 

[001 7] Figs. 5A and 5B in combination are an over-all flow chart of firewall processing for multiple domains. 

[0018] Fig. 6 is a schematic which illustrates a domain table. 

[0019] Fig. 7 Is a flow chart of an aspect of firewall processing for multiple donnains. 

[0020] Fig. 8 is a schematic which illustrates a dependency mask. 

[0021] Fig. g is a flow chart of dependency nnask processhg. 

[0022] Fig. IDA is a flow chart of proxy reflection processing at the firewall. 

[0023] Fig. 1 0B is a flow chart of proxy reflection processing at a remote proxy. 

Detailed Description 

[0024] The preferred techniques can be implemented at a firewall for controlling the flow of data between, for example, 
separate local area networks (LANs) or subnets of a LAN. Exemplary embodiments of the invention are described 
herein in terms of processes. Efficient prototypes of such processes have been implemented as computer system 
software, using the 'C programming language for implementation on general-purpose PC hardware. Efficiency can 
be enhanced further, as is known, by special-purpose firmware or hardware computer system implementations. 

1. Support for Multiple Security Domains 

[0025] With a capability for supporting multiple security domains, a single firewall can support multiple users, each 
wrth a separate security policy. Also, as different security policies can apply for communlcatbns between sub-sites, 
such a capability can be used within a site. Respective configurations are illustrated by Figs. 1 and 2. 
[0026] Fig. 1 shows four user sites 101-104, e.g.. of corporations A through D. with firewall protectkxi in their con- 
nections to the Intemet 105. Such protection is provided by a firewall facility, here in the form of a LAN 110. including 
firewall processors 111. 113 and 114. an administrator processor 115. a router 116 and a web sender 117. Each of 
firewall processors llSand 114 is dedicated to a single site, namely respective sites 103 and 104. Firewall processor 
111 is configured to sen^e the two sites 101 and 102. Firewall processor 111 implements separate firewall policies for 
each of the two sites vis-a-vIs the Intemet 105, as well as for communications between the two sites. A process for 
preferred opeiatbn of the firewall processor 1 1 1 is described below with reference to Figs. 5 A and SB, including properly 
selecting among different firewall policies. 

[0027] Fig. 2 shows a user site 201 connected to the Internet 105 via a firewall processor 211. An administrator 
processor 21 5 and a router 216 are connected to the firewall processor 211. The router 216 is connected to additional 
firewall processors 21 2 and 213 which are internal to the user site 201 . The firewall processor 212 protects a single 
subsite 223, such as Human Resources (HR). The firewall processor 21 3 is configured for protecting two subfiles, 
such as Payroll (P) and Disbursements (D), vis-a-vis the remainder of the site 201 as well as with respect to commu- 
nications between sub-sites 221 and 222. This can be achieved by empbying the process illustrated by Figs. 5A and 
58 in the firewall processor 213. 
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[0028] The security policies can be represented by sets of access rules which are represented In tabular form and 
which are loaded Into the firewall by a firewall administrator. As Illustrated in Fig. 3. such a table can provide lor cate- 
gories including rule number, designations of source and destination hosts, a designation of a special sen/ice which 
can be called for in a packet, and a specification of an action to be taken on a packet. Special sen^ices can include 

6 proxy sen/ices, network address translation, and encryption, lor example. In Fig. 3. the categories "Source Host." 
"Destination Host" and "Sen/ice" impose conditions which must be satisfied by data included in a packet for the specified 
action to be taken on that packet. Other conditions can be included, and such conditions need not relate to data included 
in the packet. For example, applicatfon of a rule can be made conditional on the time of day or day of the week. 
[0029] When a category provided for in the rule table is irrelevant In a certain rule, the corresponding table entry can 

10 be marked as a "wild card," This can apply to any one or any combinatbn of the categories. In Fig. 3 and elsewhere, 
an asterisk (*) is used for wild card entries. "FTP" stands for file transfer protocol." 

[0030] In rule processing for a packet, the rules are applied sequentially until a mle is found which Is satisfied by the 
packet (or until the mle table is exhausted. In which case the packet is dropped). For a packet to satisfy a mle. each 
condition included in the rale must be met. For example, with reference to Fig. 3. a packet from source host A to 
15 destination host D and representing mail will be dropped under Rule 20. The foltowing is a more detailed list of exemplary 
rule set categories in accordance with the Invention. The first five category names correspond to the categories shown 
in Fig. 3. 



Category Name 


Descrption 


Rule Number 


Number of rule within domain. Rule numbers do not have to be unique but should 




generally represent a single servfce, such as FTP 


Source Host 


Source host group identifier or IP address 


Destir^ation Host 


Destination host group identifier or IP address 


Sen^ice 


Service group or protocol/destinatkxi port/source port 


Action 


Rule action e.g., "pass," "drop': or "proxy" 




If "yet." an Internet Control Message Protocol (ICMP) message is sent out If action 




Is "drop" 




Numt>er od seconds of inactivity before session entry is removed from cache 


Reset Session 


If "yes," for TCP sessions, send TCP reset to both ends of connection upon cache 




timeout 


Rule Timeout 


Number of seconds of inactivity before rule is removed from rule list 


Start Period 


Start active period for rule 


End Period 


End active period lor rule 


Kill Session at End of Period 


If "yes" then any sesstons authorized by this rule will be killed at the end of the 




time period 


Dependency Mask 


Dependency mask name 


In Interface 


Interface name to match on reception 


Out Interface 


Interface name to which packet is sent 


Audit Session 


Audit record generatfon. If "yes" then audit record is generated at the beginning 




and again at the end of the session. 


Alarm Code 


Alarm code value to tie rule to partcular alarms 


Source Host Map Group 


IP address or host group containing map-to host IP addresses 


Source Host Map Type 


Type of mapping to be performed, e.g., "pool" or "direct" 


Destination Host Map Group 


IP address or host group containing map-to host IP addresses 


Destination Host Map Type 


Type of mapping to be performled, e.g.. "pool" or "direct" 


Sen/k» Map Group 


Service group containing map-to destination port numbers or the destination port. 




Protocol and source port in a referenced sen/k:e group are ignored. 


Sen/ice Map Type 


Type of mapping to be perfonmed, e.g.. "pool" or "direct" 


Max Use Total Count 


Maximun number of times this rule may be used, the rule Is removed after the 




limit Is reached. 


Max Use Concurrent Count 


Maximun of sessksns authorized by this rule which may be active at a given time. 




The rule is inactive until the count falls below the designated value. 


Copy to Address 


Address of application to which a copy of packet Is sent. Used for session 




captures. 
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(continued) 





Category Name 


Descrption 




Tunnel Destination 


Set UD a tunnel and sdnd H to this de^ttnAtion addrAs^ and nrotficol A naw IP 


5 




header will be added to the packet. 




Tunnel Requirements 


Indicates when tunnelino is reauired If *nuU" than no check is reauirfid If 'in* 
then Incoming session must have been tunneled. If, 'out" then initiate action to 
tunnel packet. If 'both* then do both. 


10 


IPSEC Requirements 


Indicates when IP Security (IPSEC) processing is required. If "null" then nocheck 




is required. If. 'in* then incoming session must have been protected using 1 PSEC. 
If 'out* then initiate action to add IPSEC protection. If *both' then do both. 




Sequence Number Randomize 


Option to randomize TCP sequence numbers. Default is 'no.' 




Syn Stomi Protectbn 


Provide protection from "syn storm* attacks. Default is 'no.' 


IS 


Authorize Return Channel 


If 'yes.* initial packet will create fooA/ard and reverse channels in cache with same 




actbn. Default is "yes.* 



2. Stateful Packet Filtering 



20 [0031] A computer network firewall in accordance with the invention can be configured to utilize 'stateful* packet 
filtering which improves pedonmance by storing in a cache the results of rule processing as applied to one or more 
packets. Stateful packet filtering may be implemented by caching rule processing results for received packets, and 
then utilizing the cached results to bypass rule processing for subsequent similar packets. For example, the results of 
applying a rule set to a packet of a given network session may be cached, such that when a subsequent packet from 

2S the same network session arrives in the firewall, the cached results from the prevksus packet are used for the subse- 
quent packet. This avokis the need to apply the rule set to each incoming packet, and thereby provides substantial 
performance advantages over conventional firewalls. 

[0032] As the number of cache entries can grow to many times the number of rules, efficient use of a cache may 
require indexing (using a hash table, tor example). As illustrated by Fig. 4. the cache can include a 'session key," 

30 hardware address infonnation. interface information, the number of the applicable rule, an alarm code, statistical in- 
formation, and an applicable action. The session key includes at least one hisader item which was appended to the 
data to be transmitted in the packet, and in an exemplary embodiment includes (i) the Internet protocol (IP) source 
address, (ii) the IP destination address, (iii) the next-level protocol, e. g. . transmission control protocol (TCP) or universal 
datagram protocol (UDP), (iv) the source port associated with the protocol, and (v) the destination port associated with 

3S the protocol. In Fig. 4, for the session key, items (i) and (ii) are shown indivkiualiy. Items (iii) to (v) are represented by 
"telnet" or "mail" for short. 

[0033] In the firewall, a deciston module or engine, here called a 'domain support engine' (DSE) detemiines which 
security policy to use for a new network session. Each new session must be approved by the security policies of the 
source domain and the destinatksn domain(s). For connections going to the Internet, it is likely that only a single domain 
40 check is performed. The DSE makes the domain selection based on the incoming or outgoing network interface, as 
well as on the source or destination network address of each packet. Inclusion, in packets, of source or destination 
addresses allows tor multiple users to be supported by a single network interface. The incoming or outgoing network 
interface may be in the form of a network interface card (NIC), e.g., an Intel EtherExpress Pro 1Q0B card available 
from Intel Corporatton. 

45 [0034] Figs. 5A and 5B Illustrate over-all flow for packet processing by a firewall whfch supports multiple domains. 
Such processing includes determining the ctomains which the packet is to cross, examining the applicable rules to 
ascertain whether the packet may pass, and determining whether any special processing is required. In the firewall, 
each domain is associated with one or more network interfaces. Interfaces that support more than one dormin are 
separated usmg an IP address range to distinguish the packets. The following steps are included: 

so 

501: an IP packet is received by the firewall at an interface; 

502: the sessbn key is obtained from the IP header of the packet; 

503: on the basis of which interface received the packet and the source IP address of the received packet, the 
source domain is determined as described separately bek>w with reference to Figs. 6 and 7; if no domain is found, 
55 the process skips to step SOS; 

504: using the sessbn key from step 502. the cache of the source domain is searched for a match; if a match is 
found in the cache and if the action is not 'drop.' the process continues with step 505; if a match is found in the 
cache and the action is 'drop,' the packet is dropped and the process returns to step 501 ; if no match is found in 
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the cache, the rule set for the source domain is searched for a match; if a match is found in the rules and if the 
action is not 'drop.' the process continues with step 505; if a match is found in the rules and the action is "drop,* 
a corresponding entry is included in the cache, the packet Is dropped, and the process retums to step 501; if no 
match is found in the rules, the packet is dropped and the process returns to step 501 ; 
s 505: the destination interlace is determined using the local area network (LAN) address of the packet, and. if the 

source domain rule specifies a destination interface, using that destination interface and a routing table; 
506: using the destinatk>n interface and the destination address of th e packet, the destination domain is determined; 
if the destinatk»i domain is not found, or if the destination domain matches the donrtain just checked, the process 
skips to step 508; 

10 507: cache look-up and. if required, rule set kx5k-up for the destination domain are carried out in a manner anal- 

ogous to that employed for the source domain in step 504; 

508: if a rule that applies to the packet calls for an address change, e.g., to a proxy or for insertion of one packet 
. into another (tunnel option'), the process retums to step 505 for processing based on the changed destinatkxi; 
509: if the packet was not processed with respect to any domain, the packet can be dropped, as a firewall owner 
IS has no interest In supporting communications between interfaces whk:h are not subject to any access rules; 
51 0: with all actions having resulted in 'pass,' the packet Is sent out the appropriate network interlace. 

[0035] For convenient linking of each network interface to a domain, a domain table is used. In cases where an 
interface is shared by multiple domains, an address range is included. This Is illustrated by Fig. 6 which shows non- 
^ overlapping address ranges. 

[0036] Fig. 7 illustrates domain table processing as performed in steps 503 and 506 described above, including the 
folk)wlng steps: 

701: the domain table is searched for a match of the interface name; 

702: if matching table entry is found, and if the IP address range is present in the matching table entry, the packet 
address is checked as to whether it is within the range; if so, the specified domain is selected; otherwise, the search 
continues with the next table entiy; 

703: if the end of the table is reached without a match having been found, no action is taken. 
30 3. Dependency Mask 

[0037] For protocols of the type which require a separate, additional network session from the outside back to the 
user, such as. for example, the protocol employed by RealAudio, a rule can include a condition or rr^sk that allows a 
connection back to a user, but only if there is a proper forward connection concurrently active, i.e., a connection in 
3S which the source and destination addresses are interchanged. As a result, there is no need for a separate or proxy 
application on the firewall. 

[0038] A dependency mask in accordance with the invention can define a query directed to the session cache. A 
match is determined by matching all fields defined in the mask with the corresponding flekis in the cache. Empty fields 
within the mask are not used for comparison. 
40 [0039] A dependency mask may be defined in a rule for the first packet of a network session, using (a) Information 
in the packet, (b) the source interface for that packet and (c) one or several dependency conditions that must be met 
for the packet to pass. When such a first packet has been processed by the firewall, a corresponding entry is made in 
the cache. 

[0040] Fig. 8 shows mles with a dependency mask ("hit count") in a format similar to that of Fig. 3. Special symbols 
are included for certain host designations, namely (i) a "dot" symbol (,) calling for inclusion of packet data of the cor- 
responding category, and (il) a caret symbol (^) calling for inclusion of packet data from a certain different category 
instead. "Hit count" indicates the number of matches which must be found in the cache for the speciTied action to be 
taken. For example, in the dependency mask named "reataudb," a count of 1 is used for passing UDP packets provkJed 
one requisite TCP sesskxi is active. In the dependency mask "telnet." a count of 1 0 is used to drop packets to prevent 
so overloading of resources. 

[0041] Fig. 9 illustrates dependency mask processing including the following steps: 

901: the packet is obtained and the session key is extracted; 

902: the process steps through the rule set entries; if no match is found with a given rule, the process advarK:e6 
ss to the next rule in the set; if no match is found by the time the rule set is exhausted, the packet is dropped; if a 

match is found and the dependency mask fieM is null, the process skips to step 905; 

903: the packet and interface information may be included in the formation of a cache search structure, e.g.. a 
query; if a user authenticatbn flag is set in the dependency mask, the corresponding flag is set in the cache search 
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structure; this defines the query portion ot a rule; 

904: the cache is searched for a match with the cache search structure and a count of matches is accumulated; 
this is processing the quer/ portion of the rule; 

905: if the accumulated count is equal to or greater than the hit count, the rule is selected and the action associated 
5 with the rule is performed; such action may include pass, drop or proxy; also, a corresponding entry is made in 

the cache; it no match is found in the cache, or if fewer than 'hit count' entries were found in the cache, the process 
returns to step 902 to find another rule; this is processing of the action portbn of the rule as a function of the result 
of the query. 

10 [0042] Rule processing, including the above-described dependency mask processing, is performed only on the first 
packet of a network session. All other packets bypass the nile search functions because their action has been saved 
in the sesskxi cache after processing of the first packet. 
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4. Dynamic Rules 



[0043] Dynamic rules are rules which are included with the access rules as a need arises, for processing along with 
the access rules, e.g.. by a rule processing engine. Dynamic rules can include unique, current information such as, for 
example, specific source and destination port numbers. They can be loaded at any time by trusted parties, e.g.. a 
trusted apptk:ation, remote proxy or firewall administrator, to authorize specific network sessions. A dynamic rule can 
20 be set for single-session use. or its use can be limited as to lime. Once a dynamic rule has served its function, it can 
be removed from the rule set. The dynamic rules allow a given rule set to be modified based on events happening In 
the network without requiring that the entire rule set be reloaded. 

[0044] Exemplary dynamic rules include a 'one-time' rule which is only used for a single sessk^n. a time-fimited rule 

which is used only for a specified time period, and a threshold rule which is used only when certain conditbns are - 

ss satisfied. Another type of dynamic rule includes rules which define a host group, such that the host group can be - ^kl^ 

modified to add or drop different hosts without altering other aspects of the access rule set. Other dynamic rules may 
be used to facilitate rule setup in certain specific types of processing appltcattons. For example, an FTP proxy appH* * . c 

cation coukJ use a dynamic rule to authorize establishment of an FTP data channel in response to a data request The 
dynamic rule in this example would typically not be loaded until a data request is made over the FTP control session, 

30 and could be limited to one use and made active for only a limited time period. The rule set therefore need not include ,? 
a separate data channel rule for use with all requests. As a result, the rule specification and rule processing are sim- 
plified, and security Is improved. fr^^'^ 



5. Proxy Reflection 



[0045] Proxy reflection in accordance with the present invention involves redirecting a network session to another, 
'remote* proxy sen/er for processing, and then later passing It back via the firewall to the intended destination. When 
a new session enters the firewall, a declston is made to determine whether service by a proxy sen/er is required. If so, 
the firewall replaces the destination address In the packet with the host address of the proxy app(icatk>n and, If nec- 
40 essary. it can also change the servce port. When the proxy applicatbn receives the sessbn, it will request from the 
firewall the original destination address of the session for determining whether the connection to the destinatkMi is 
authorized. If the proxy then makes the connection to that destinatk>n as itself, using its own IP address, the service 
provided by the firewall will be called 'single reflection* or 'one-way reflection.' 

[0046] For some users and proxy applications, the connection should appear at the destination to be coming from 
45 the original source rather than the remote system. This applies, e.g., to services which check the source IP address 
to ensure that it matches the user who signed up for the requested sen^ice. This capability Is provkled by *duat reflectbn' 
(or two-way reflection'), with the source address of the outgoing connection changed back from the remote proxy to 
the original user's source address. This change is effected at the firewall, as each packet is received from the proxy 
and sent to the destination. 

so [0047] To provide dual reflectton capability, the proxy applicatbn requests from the firewall the details of the original, 
incoming network sessbn. The firewall returns a port number to use on the outgoing connection. This port number is 
unique and will allow the firewall to identify the prefer outgoing connection so that It can map the source address to 
the proper user source address. As a result, the proxy applicatbn is invisible to both parties. 
[0048] In implementing proxy reflection, dynamb rules can be used as described below for an illustrative embodiment. 

ss with reference to Figs. 1 0A and 1 0B. 

[0049] Fig. 10A illustrates proxy reflection processing including the foltowing steps at the firewall: 

1001 : packet is received by the firewall; 
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1002: action associated with the packet is determined by looking in the appropriate session cache or. If not found 
In the cache, in the appropriate rule sot; if the action is "pass" or "proxy/ packet processing continues; ii the action 
is "drop.* the packet is dropped: 

1003: if the action indicates a proxy application supported locally on the firewall, the packet is sent up the protocol 
s stack to an awaiting proxy application: 

1004: if the action indicates a remote proxy, the packet's destination address is replaced with the address of the 
remote proxy; If configured, the destination port can be changed as well; the original packet header data Is recorded 
In the session cache along with any changed values; 
1005: the packet is routed to the remote proxy sender. 

10 

[0050] Fig. 10B illustrates processing at the remote proxy, subsequent to step 1005. including the following steps: 

1005: the packet is received in the remote proxy server application; 
1007: the remote proxy contacts the firewall for the original session key for the packet; 
IS 1008: the remote proxy application uses the original session key to perform Us function, such as dropping the 

connection based on its own security model, performing the requested service, or contacting the original destination 
address on behalf of the user; if the remote proxy is using single reflectk>n. the process skips to step 1011 ; 
1009: the remote proxy application contacts the firewall over the encrypted channel to request dual refleclton 
capability; 

20 1 01 0: the firewall determines a new destination port number that will guarantee uniqueness of the connection from 

the sender; the firewall passes this new port number and the original session key back to the proxy applicatton; 
101 1 : the remote proxy application requests permission from the firewall for a connection from itself to the original 

destination; 

101 2: the firewall \oa6s a dynamic rule to perform this action; 
2$ 1 01 3: the remote proxy sends the packet to the firewall; based on the dynamic rule loaded in step 101 2. the firewall 

fonwards the packet to the original destination; in the case of dual reflection, the proxy uses the destination port 
which was determined by the firewall in step 1010. and, as the packet passes through the firewall, the IP header 
values are changed back to the original values. 

30 [0051] All future packets associated with the same session are processed alike, except that steps 1007 and 
1009-101 2 can be skipped. This is because the same dynamic rules apply for the lite of the session. 
[0052] The invention can be implemented in a wide variety of applications. For example, the Invention may be used 
to provide improved firewall performance in a dial-up access gateway Another exemplary embodiment of the invention 
may be implemented in a distributed manner with a first portion of the firewall resident in the network and a second 

3S potxkm of the firewall resident in a set-top box. computer or other user terminal In a home or business. The latter 
embodiment can alk>w the firewall technk:|ues of the imenlion to provide, for example, parental control of Intemet and 
video access in the home. These and the other above-described embodiments of the invention are intended to be 
illustrative only Numerous alternative embodiments within the scope of the following claims will be apparent to those 
skilled in the art. 

40 

Claims 

1. A method for packet valkJation in a computer network firewall, comprising the steps of: 

45 

storing in a cache a result of applying at least a portion of a rule set to a given packet of a network session; and 
utilizing the stored results to process at least one subsequent packet having a characteristic similar to that of 
the given packet. 

so 2. The method of claim 1 wherein the utilizing step includes utilizing the stored results to bypass rule processing for 
the subsequent packet. 

3. The method of claim 1 wherein the subsequent packet is from the same network 8es8k>n as the given packet. 

ss 4. The method of claim 1 wherein the utilizing step includes using a session key associated with the subsequent 
packet to retrieve the stored result from the cache. 

5. An apparatus for use in validating a packet in a firewall of a computer network, comprising: 



8 



BNSOOCID: <EPj__0909072A2J_> 



EP0909 072A2 



a memory for storing a cache containing a resuK of applying at least a portion of a rule set to a given packet 
of a network session; and 

a processor coupled to the memory, wherein the processor Is operative to utilize the stored results to process 
at least one subsequent packet having a characteristic similar to that of the given packet. 

6. The apparatus of claim 5 wherein the processor is further operative to utilize the stored results to bypass rule 
processing for the subsequent packet. 

7. The apparatus of claim 5 wherein the subsequent packet is from the same network session as the given packet. 

8. The apparatus of claim 5 wherein the processor is further operative to use a session key associated with the 
subsequent packet to retrieve the stored result from the cache. 

9. A computer system for packet validatbn in a computer network, comprising means for canying out each step in 
a method as claimed in any of claims 1 to 4. 

10. A computer system for packet validation in a computer network, comprising a processor which is instructed to 
carry out a method as claimed in any of claims 1 to 4. 
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